Virtual Machine Isolation for Encrypted Virus Detection

The patent segments the scanning process into two distinct phases: an initial fast scan using virus signatures on file headers and known patterns, and a subsequent emulation scan on suspicious sections. This segmentation allows the system to maintain low resource consumption during routine scanning while allocating resources intensively only when needed, resolving the contradiction between detection capability and resource usage.

The patent introduces an intermediary emulation environment that acts as a mediator between the file system and the virus detection engine. This intermediary layer executes suspicious code in a controlled virtual environment, allowing detection of encrypted and polymorphic viruses without requiring resource-intensive scanning of entire files, thus improving detection precision while managing resource consumption.

The patent applies preliminary action by performing fast signature-based scanning on file headers and known patterns before initiating emulation. This preliminary detection phase identifies obviously malicious files and suspicious sections that require emulation, allowing the system to prepare and control the emulation process before the virus can execute, thus preventing infection while maintaining high detection precision.

The patent implements preliminary anti-action by establishing a controlled emulation environment with pre-configured security measures before executing suspicious code. The emulation sandbox is prepared in advance with restricted system access and monitoring capabilities, preventing viruses from executing harmful actions even if they decrypt themselves during emulation, thereby counteracting the potential harm before it occurs.